mediumMultiple SelectObjective-mapped
350-701 Practice Question: Migrating critical workloads to AWS and wants to…
A company is migrating critical workloads to AWS and wants to ensure secure connectivity between their on-premises network and the VPC. Which TWO actions should be taken to meet this requirement?
⚠ Common exam trap
Cisco often tests the misconception that security groups or network ACLs alone can provide secure connectivity, when in fact they are only access control mechanisms that require an underlying transport (VPN or Direct Connect) to establish the link.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Provision an AWS Direct Connect connection for a private, dedicated link.
Options C and E are correct. AWS Direct Connect (C) provides a private, dedicated link from on-premises to AWS, bypassing the public internet for consistent latency and enhanced security. AWS Site-to-Site VPN (E) also provides secure connectivity over the internet using IPsec tunnels, offering a more cost-effective alternative. Both options meet the requirement for secure connectivity between on-premises and the VPC. Options A and D are incorrect because security groups and internet gateways alone do not establish a secure connection; they require an underlying encrypted transport. Option B is vague and not a best practice for secure connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an internet gateway to the VPC and allow all inbound traffic.
Why it's wrong here
Internet gateway enables internet access, not private connectivity to on-prem.
- ✗
Configure a security group that allows all traffic from the on-premises network.
Why it's wrong here
Security groups are stateful firewalls for instances, not for site-to-site VPN connectivity.
- ✓
Provision an AWS Direct Connect connection for a private, dedicated link.
Why this is correct
Direct Connect provides a private, low-latency connection bypassing the internet.
- ✗
Use security groups to allow traffic from the on-premises IP range.
Why it's wrong here
Security groups alone do not establish connectivity; they are just firewall rules.
- ✓
Deploy an AWS Site-to-Site VPN connection using IPsec.
Why this is correct
Site-to-Site VPN provides encrypted tunnels over the internet between on-prem and VPC.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.